@settlemint/dalp-cli 3.1.32-main.42600267094 → 3.1.32-main.42617163864

package/dist/{openapi-surface-pse7kjt8.json → openapi-surface-qq1cnv3e.json}

@@ -76998,6 +76998,48 @@
         }
       ]
     },
+    "tokenSaleV2.v2/addons/tokenSale/settleInvestments": {
+      "name": "tokenSaleV2.v2/addons/tokenSale/settleInvestments",
+      "method": "POST",
+      "url": "/api/v2/addons/token-sales/investment-settlements",
+      "summary": "Claim tokens and refunds from ended sales",
+      "description": "Verifies the wallet once, then settles each named sale for the acting wallet: a successful sale withdraws the tokens it owes now, a failed sale refunds each payment currency it still holds. Each claim or refund is its own queued transaction, sent one after another, and a failed one does not stop the others. A sale that owes the wallet nothing comes back skipped. Answers 200 with one result per claim or refund. Name at most 20 sales per request. Repeat with the same idempotency key to get the same transactions back instead of sending new ones. A browser wallet cannot settle several sales in one request; it signs each claim or refund on the sale's own routes.",
+      "help": "Verifies the wallet once, then settles each named sale for the acting wallet: a successful sale withdraws the tokens it owes now, a failed sale refunds each payment currency it still holds. Each claim or refund is its own queued transaction, sent one after another, and a failed one does not stop the others. A sale that owes the wallet nothing comes back skipped. Answers 200 with one result per claim or refund. Name at most 20 sales per request. Repeat with the same idempotency key to get the same transactions back instead of sending new ones. A browser wallet cannot settle several sales in one request; it signs each claim or refund on the sale's own routes.",
+      "tags": [
+        "Primary offerings"
+      ],
+      "pathParams": [],
+      "queryParams": [],
+      "headerParams": [
+        {
+          "name": "Idempotency-Key",
+          "in": "header",
+          "required": false,
+          "description": "Retry key for one mutation. Reuse it only for the same method, path, and body on a route that documents replay safety. If omitted, the platform generates a UUIDv7 key; replay-safe writes echo it in the `Idempotency-Key` response header. A lost response still requires status reconciliation.",
+          "type": "string",
+          "enum": null,
+          "pattern": null,
+          "examples": [],
+          "fields": []
+        },
+        {
+          "name": "Prefer",
+          "in": "header",
+          "required": false,
+          "description": "RFC 7240 preference; separate directives with commas. `wait=N` holds each collected item up to N seconds, clamped to 5 through 99; an item that has not settled by then comes back queued. Without `wait`, every item comes back queued.",
+          "type": "string",
+          "enum": null,
+          "pattern": null,
+          "examples": [],
+          "fields": []
+        }
+      ],
+      "requestBodyDescription": "The ended sales to settle for the acting wallet, one to 20. A sale named twice is settled once.",
+      "hasRequestBody": true,
+      "bodyIsComplex": true,
+      "bodyFields": [],
+      "examples": []
+    },
     "tokenSaleV2.v2/addons/tokenSale/transition": {
       "name": "tokenSaleV2.v2/addons/tokenSale/transition",
       "method": "POST",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@settlemint/dalp-cli",
-  "version": "3.1.32-main.42600267094",
+  "version": "3.1.32-main.42617163864",
   "private": false,
   "description": "CLI for the Digital Asset Lifecycle Platform — manage tokens, identities, compliance, and more from the command line.",
   "homepage": "https://settlemint.com",
@@ -50,14 +50,14 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "2.4.0",
-    "@settlemint/dalp-sdk": "3.1.32-main.42600267094",
+    "@settlemint/dalp-sdk": "3.1.32-main.42617163864",
     "incur": "0.7.1",
     "zod": "4.6.7"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
-    "@testkit/effect-bun-test": "3.1.32-main.42600267094",
-    "@tools/typescript-config": "3.1.32-main.42600267094",
+    "@testkit/effect-bun-test": "3.1.32-main.42617163864",
+    "@tools/typescript-config": "3.1.32-main.42617163864",
     "@types/bun": "1.4.4",
     "publint": "0.3.25"
   },

package/src/generated/openapi-surface.json

@@ -76998,6 +76998,48 @@
         }
       ]
     },
+    "tokenSaleV2.v2/addons/tokenSale/settleInvestments": {
+      "name": "tokenSaleV2.v2/addons/tokenSale/settleInvestments",
+      "method": "POST",
+      "url": "/api/v2/addons/token-sales/investment-settlements",
+      "summary": "Claim tokens and refunds from ended sales",
+      "description": "Verifies the wallet once, then settles each named sale for the acting wallet: a successful sale withdraws the tokens it owes now, a failed sale refunds each payment currency it still holds. Each claim or refund is its own queued transaction, sent one after another, and a failed one does not stop the others. A sale that owes the wallet nothing comes back skipped. Answers 200 with one result per claim or refund. Name at most 20 sales per request. Repeat with the same idempotency key to get the same transactions back instead of sending new ones. A browser wallet cannot settle several sales in one request; it signs each claim or refund on the sale's own routes.",
+      "help": "Verifies the wallet once, then settles each named sale for the acting wallet: a successful sale withdraws the tokens it owes now, a failed sale refunds each payment currency it still holds. Each claim or refund is its own queued transaction, sent one after another, and a failed one does not stop the others. A sale that owes the wallet nothing comes back skipped. Answers 200 with one result per claim or refund. Name at most 20 sales per request. Repeat with the same idempotency key to get the same transactions back instead of sending new ones. A browser wallet cannot settle several sales in one request; it signs each claim or refund on the sale's own routes.",
+      "tags": [
+        "Primary offerings"
+      ],
+      "pathParams": [],
+      "queryParams": [],
+      "headerParams": [
+        {
+          "name": "Idempotency-Key",
+          "in": "header",
+          "required": false,
+          "description": "Retry key for one mutation. Reuse it only for the same method, path, and body on a route that documents replay safety. If omitted, the platform generates a UUIDv7 key; replay-safe writes echo it in the `Idempotency-Key` response header. A lost response still requires status reconciliation.",
+          "type": "string",
+          "enum": null,
+          "pattern": null,
+          "examples": [],
+          "fields": []
+        },
+        {
+          "name": "Prefer",
+          "in": "header",
+          "required": false,
+          "description": "RFC 7240 preference; separate directives with commas. `wait=N` holds each collected item up to N seconds, clamped to 5 through 99; an item that has not settled by then comes back queued. Without `wait`, every item comes back queued.",
+          "type": "string",
+          "enum": null,
+          "pattern": null,
+          "examples": [],
+          "fields": []
+        }
+      ],
+      "requestBodyDescription": "The ended sales to settle for the acting wallet, one to 20. A sale named twice is settled once.",
+      "hasRequestBody": true,
+      "bodyIsComplex": true,
+      "bodyFields": [],
+      "examples": []
+    },
     "tokenSaleV2.v2/addons/tokenSale/transition": {
       "name": "tokenSaleV2.v2/addons/tokenSale/transition",
       "method": "POST",

package/src/lib/credential-store.ts

@@ -8,6 +8,9 @@ const KEYCHAIN_ENTRY_SEPARATOR_PATTERN = /\n(?=keychain:)/u;
 const ACCOUNT_PATTERN = /"acct"<blob>="([^"]*)"/u;
 
 const SERVICE_NAME = "dalp-cli";
+const SECURITY_INTERACTIVE_MAX_LINE_BYTES = 4094;
+const SECURITY_QUOTED_ESCAPE_PATTERN = /["\\]/gu;
+const SECURITY_LINE_BREAK_PATTERN = /[\n\r\0]/u;
 
 const StoredCredentialsSchema = z.object({
   apiKey: z.string().min(1),
@@ -24,14 +27,20 @@ export interface CredentialStoreOptions {
   readonly configDir?: string;
   readonly platform?: NodeJS.Platform;
   readonly runSecurity?: (
-    args: ReadonlyArray<string>
+    args: ReadonlyArray<string>,
+    stdin?: string
   ) => Promise<{ readonly exitCode: number; readonly stdout: string }>;
 }
 
 const defaultRunSecurity = async (
-  args: ReadonlyArray<string>
+  args: ReadonlyArray<string>,
+  stdin?: string
 ): Promise<{ readonly exitCode: number; readonly stdout: string }> => {
-  const proc = Bun.spawn(["security", ...args], { stdout: "pipe", stderr: "pipe" });
+  const proc = Bun.spawn(["security", ...args], {
+    stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
+    stdout: "pipe",
+    stderr: "pipe",
+  });
   const [stdout, exitCode] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
   return { exitCode, stdout };
 };
@@ -76,6 +85,43 @@ async function deleteKeychainAccount(
   }
 }
 
+function quoteSecurityArgument(value: string): string {
+  return `"${value.replaceAll(SECURITY_QUOTED_ESCAPE_PATTERN, (character) => `\\${character}`)}"`;
+}
+
+async function addKeychainPassword(
+  runSecurity: NonNullable<CredentialStoreOptions["runSecurity"]>,
+  account: string,
+  password: string
+): Promise<void> {
+  const command = [
+    "add-generic-password",
+    "-s",
+    quoteSecurityArgument(SERVICE_NAME),
+    "-a",
+    quoteSecurityArgument(account),
+    "-X",
+    Buffer.from(password, "utf8").toString("hex"),
+    "-U",
+  ].join(" ");
+  if (
+    SECURITY_LINE_BREAK_PATTERN.test(account) ||
+    Buffer.byteLength(command, "utf8") > SECURITY_INTERACTIVE_MAX_LINE_BYTES
+  ) {
+    throw makeCliError({
+      code: "kit.cli.CREDENTIAL_STORE_FAILED",
+      message: `The ${SERVICE_NAME} keychain item for ${JSON.stringify(account)} cannot be passed to the macOS security tool as one command line.`,
+    });
+  }
+  const result = await runSecurity(["-i"], `${command}\n`);
+  if (result.exitCode !== 0) {
+    throw makeCliError({
+      code: "kit.cli.CREDENTIAL_STORE_FAILED",
+      message: `Keychain save failed with exit code ${result.exitCode}`,
+    });
+  }
+}
+
 function resolvePlatform(options: CredentialStoreOptions): NodeJS.Platform {
   if (options.platform !== undefined) {
     return options.platform;
@@ -99,22 +145,7 @@ export async function saveCredentials(
 
   if (platform === "darwin") {
     const existing = await keychainAccounts(runSecurity);
-    const result = await runSecurity([
-      "add-generic-password",
-      "-s",
-      SERVICE_NAME,
-      "-a",
-      parsed.userEmail,
-      "-w",
-      encoded,
-      "-U",
-    ]);
-    if (result.exitCode !== 0) {
-      throw makeCliError({
-        code: "kit.cli.CREDENTIAL_STORE_FAILED",
-        message: `Keychain save failed with exit code ${result.exitCode}`,
-      });
-    }
+    await addKeychainPassword(runSecurity, parsed.userEmail, encoded);
     try {
       for (const account of existing.filter((name) => name !== parsed.userEmail)) {
         await deleteKeychainAccount(runSecurity, account);